Dockerfile

FROM node:22-alpine AS base
WORKDIR /app
ENV NODE_ENV=production

RUN apk add --no-cache ca-certificates

FROM base AS deps
COPY package.json package-lock.json* ./
RUN apk add --no-cache python3 make g++ \
  && npm ci --omit=dev --no-audit --no-fund --progress=false

FROM base AS builder
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build --if-present

FROM node:22-alpine AS release
WORKDIR /app
ENV NODE_ENV=production

# Create non-root user
RUN addgroup -S app && adduser -S -G app app
COPY --from=builder /app /app
EXPOSE 3000
USER app

# Lightweight healthcheck using node
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node -e "const http=require('http');const req=http.get({hostname:'127.0.0.1',port:process.env.PORT||3000,path:'/health'},res=>{if(res.statusCode>=200&&res.statusCode<400)process.exit(0);else process.exit(1)});req.on('error',()=>process.exit(1));"

CMD ["npm","start"]